aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-04-20Update version for 2.8.1.1 releasev2.8.1.1Michael Roth
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-04-209pfs: local: set the path of the export root to "."Greg Kurz
The local backend was recently converted to using "at*()" syscalls in order to ensure all accesses happen below the shared directory. This requires that we only pass relative paths, otherwise the dirfd argument to the "at*()" syscalls is ignored and the path is treated as an absolute path in the host. This is actually the case for paths in all fids, with the notable exception of the root fid, whose path is "/". This causes the following backend ops to act on the "/" directory of the host instead of the virtfs shared directory when the export root is involved: - lstat - chmod - chown - utimensat ie, chmod /9p_mount_point in the guest will be converted to chmod / in the host for example. This could cause security issues with a privileged QEMU. All "*at()" syscalls are being passed an open file descriptor. In the case of the export root, this file descriptor points to the path in the host that was passed to -fsdev. The fix is thus as simple as changing the path of the export root fid to be "." instead of "/". This is CVE-2017-7471. Cc: qemu-stable@nongnu.org Reported-by: Léo Gaspard <leo@gaspard.io> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 9c6b899f7a46893ab3b671e341a2234e9c0c060e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-30Update version for 2.8.1 releasev2.8.1Michael Roth
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-30spapr: fix off-by-one error in spapr_ovec_populate_dt()Sam Bobroff
The last byte of the option vector was missing due to an off-by-one error. Without this fix, client architecture support negotiation will fail because the last byte of option vector 5, which contains the MMU support, will be missed. Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> (cherry picked from commit fe93e3e6ec1b1bf4a4c9d4bf55f8776318da6847) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-30seabios: update to 1.10.2 releaseGerd Hoffmann
git shortlog rel-1.10.1..rel-1.10.2 =================================== Ben Warren (5): QEMU DMA: Add DMA write capability romfile-loader: Switch to using named structs QEMU fw_cfg: Add command to write back address of file QEMU fw_cfg: Add functions for accessing files by key QEMU fw_cfg: Write fw_cfg back on S3 resume Kevin O'Connor (1): ps2port: Disable keyboard/mouse prior to resetting ps2 controller Ladi Prosek (1): ahci: Set upper 32-bit registers to zero Paul Menzel (1): vgasrc: Increase debug level Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 8779fccbef0c2e97fd6564ddf9f1df9fc724f2f0) * required for 98cb5dc: "ahci: advertise HOST_CAP_64" Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-30qom: Fix regression with 'qom-type'Eric Blake
Commit 9a6d1ac assumed that 'qom-type' could be removed from QemuOpts with no ill effects. However, this command line proves otherwise: $ ./x86_64-softmmu/qemu-system-x86_64 -nodefaults -nographic -qmp stdio \ -object rng-random,filename=/dev/urandom,id=rng0 \ -device virtio-rng-pci,rng=rng0 qemu-system-x86_64: -object rng-random,filename=/dev/urandom,id=rng0: Parameter 'qom-type' is missing Fix the regression by restoring qom-type in opts after its temporary removal that was needed for the duration of user_creatable_add_opts(). Reported-by: Richard W. M. Jones <rjones@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Tested-by: Richard W.M. Jones <rjones@redhat.com> Message-id: 20170323160315.19696-1-eblake@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 08329701199449bde497570dcfdb9c86062baf20) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-30target/s390x: Fix broken user modeStefan Weil
Returning NULL from get_max_cpu_model results in a SIGSEGV runtime error. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20170130131517.8092-1-sw@weilnetz.de> Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit a352aa62a75fcb1db35a0c71a10af3b2c1f8b89f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-30qapi: Fix QemuOpts visitor regression on unvisited inputEric Blake
An off-by-one in commit 15c2f669e meant that we were failing to check for unparsed input in all QemuOpts visitors. Recent testsuite additions show that fixing the obvious bug with bogus fields will also fix the case of an incomplete list visit; update the tests to match the new behavior. Simple testcase: ./x86_64-softmmu/qemu-system-x86_64 -nodefaults -nographic -qmp stdio -numa node,size=1g failed to diagnose that 'size' is not a valid argument to -numa, and now once again reports: qemu-system-x86_64: -numa node,size=1g: Invalid parameter 'size' See also https://bugzilla.redhat.com/show_bug.cgi?id=1434666 CC: qemu-stable@nongnu.org Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20170322144525.18964-4-eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 21f88d021d0d2b4ecee8f6cd6ca63a943a3ce71d) Conflicts: qapi/opts-visitor.c tests/test-opts-visitor.c * drop changes related to 9cb8ef36 and a9416dc6 tests Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-30qom: Avoid unvisited 'id'/'qom-type' in user_creatable_add_optsEric Blake
A regression in commit 15c2f669e caused us to silently ignore excess input to the QemuOpts visitor. Later, commit ea4641 accidentally abused that situation, by removing "qom-type" and "id" from the corresponding QDict but leaving them defined in the QemuOpts, when using the pair of containers to create a user-defined object. Note that since we are already traversing two separate items (a QDict and a QemuOpts), we are already able to flag bogus arguments, as in: $ ./x86_64-softmmu/qemu-system-x86_64 -nodefaults -nographic -qmp stdio -object memory-backend-ram,id=mem1,size=4k,bogus=huh qemu-system-x86_64: -object memory-backend-ram,id=mem1,size=4k,bogus=huh: Property '.bogus' not found So the only real concern is that when we re-enable strict checking in the QemuOpts visitor, we do not want to start flagging the two leftover keys as unvisited. Rearrange the code to clean out the QemuOpts listing in advance, rather than removing items from the QDict. Since "qom-type" is usually an automatic implicit default, we don't have to restore it (this does mean that once instantiated, QemuOpts is not necessarily an accurate representation of the original command line - but this is not the first place to do that); however "id" has to be put back (requiring us to cast away a const). [As a side note, hmp_object_add() turns a QDict into a QemuOpts, then calls user_creatable_add_opts() which converts QemuOpts into a new QDict. There are probably a lot of wasteful conversions like this, but cleaning them up is a much bigger task than the immediate regression fix.] CC: qemu-stable@nongnu.org Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20170322144525.18964-3-eblake@redhat.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 9a6d1acb3e752e1e0b693cc0491fa12875b76be0) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> (cherry picked from commit 7967e0bd9d8c4d7aae11383f9d9bad2ceaf9c2a2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-30monitor: reuse user_creatable_add_opts() instead of user_creatable_add()Igor Mammedov
Simplify code by dropping ~57LOC by merging user_creatable_add() into user_creatable_add_opts() and using the later from monitor. Along with it allocate opts_visitor_new() once in user_creatable_add_opts(). As result we have one less API func and a more readable/simple user_creatable_add_opts() vs user_creatable_add(). Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <1484052795-158195-3-git-send-email-imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> (cherry picked from commit 3a4641054e320d8ad7e780c30010b1c1dbfc56e8) * functional dep for 9a6d1ac Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-30tests: Expose regression in QemuOpts visitorEric Blake
Commit 15c2f669e broke the ability of the QemuOpts visitor to flag extra input parameters, but the regression went unnoticed because of missing testsuite coverage. Add a test to cover this; take the approach already used in 9cb8ef3 of adding a test that passes (to avoid breaking bisection) but marks with BUG the behavior that we don't like, so that the actual impact of the fix in a later patch is easier to see. CC: qemu-stable@nongnu.org Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Message-Id: <20170322144525.18964-2-eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 76861f6befc50c30cb71e84b372dc91dd26656a4) Conflicts: tests/test-opts-visitor.c * drop context dep on 9cb8ef36 and a9416dc6 tests Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-27virtio: always use handle_aio_output if registeredPaolo Bonzini
Commit ad07cd6 ("virtio-scsi: always use dataplane path if ioeventfd is active", 2016-10-30) and 9ffe337 ("virtio-blk: always use dataplane path if ioeventfd is active", 2016-10-30) broke the virtio 1.0 indirect access registers. The indirect access registers bypass the ioeventfd, so that virtio-blk and virtio-scsi now repeatedly try to initialize dataplane instead of triggering the guest->host EventNotifier. Detect the situation by checking vq->handle_aio_output; if it is not NULL, trigger the EventNotifier, which is how the device expects to get notifications and in fact the only thread-safe manner to deliver them. Fixes: ad07cd6 Fixes: 9ffe337 Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit e49a6618400d11e51e30328dfe8d7cafce82d4bc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16Gerd Hoffmann
The switch from pointers to addresses (commit 026aeffcb4752054830ba203020ed6eb05bcaba8 and ffaf857778286ca54e3804432a2369a279e73aa7) added a off-by-one bug to 16bit backward blits. Fix. Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Li Qiang <liqiang6-s@360.cn> Message-id: 1489735296-19047-1-git-send-email-kraxel@redhat.com (cherry picked from commit f019722cbbb45aea153294fc8921fcc96a4d3fa2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21cirrus: stop passing around src pointers in the blitterGerd Hoffmann
Does basically the same as "cirrus: stop passing around dst pointers in the blitter", just for the src pointer instead of the dst pointer. For the src we have to care about cputovideo blits though and fetch the data from s->cirrus_bltbuf instead of vga memory. The cirrus_src*() helper functions handle that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489584487-3489-1-git-send-email-kraxel@redhat.com (cherry picked from commit ffaf857778286ca54e3804432a2369a279e73aa7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21cirrus: stop passing around dst pointers in the blitterGerd Hoffmann
Instead pass around the address (aka offset into vga memory). Calculate the pointer in the rop_* functions, after applying the mask to the address, to make sure the address stays within the valid range. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489574872-8679-1-git-send-email-kraxel@redhat.com (cherry picked from commit 026aeffcb4752054830ba203020ed6eb05bcaba8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21cirrus: fix cirrus_invalidate_regionGerd Hoffmann
off_cur_end is exclusive, so off_cur_end == cirrus_addr_mask is valid. Fix calculation to make sure to allow that, otherwise the assert added by commit f153b563f8cf121aebf5a2fff5f0110faf58ccb3 can trigger for valid blits. Test case: boot windows nt 4.0 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489579606-26020-1-git-send-email-kraxel@redhat.com (cherry picked from commit e048dac616748273c2153490e9fdf1da242f0cad) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21cirrus/vnc: zap bitblit support from console code.Gerd Hoffmann
There is a special code path (dpy_gfx_copy) to allow graphic emulation notify user interface code about bitblit operations carryed out by guests. It is supported by cirrus and vnc server. The intended purpose is to optimize display scrolls and just send over the scroll op instead of a full display update. This is rarely used these days though because modern guests simply don't use the cirrus blitter any more. Any linux guest using the cirrus drm driver doesn't. Any windows guest newer than winxp doesn't ship with a cirrus driver any more and thus uses the cirrus as simple framebuffer. So this code tends to bitrot and bugs can go unnoticed for a long time. See for example commit "3e10c3e vnc: fix qemu crash because of SIGSEGV" which fixes a bug lingering in the code for almost a year, added by commit "c7628bf vnc: only alloc server surface with clients connected". Also the vnc server will throttle the frame rate in case it figures the network can't keep up (send buffers are full). This doesn't work with dpy_gfx_copy, for any copy operation sent to the vnc client we have to send all outstanding updates beforehand, otherwise the vnc client might run the client side blit on outdated data and thereby corrupt the display. So this dpy_gfx_copy "optimization" might even make things worse on slow network links. Lets kill it once for all. Oh, and one more reason: Turns out (after writing the patch) we have a security bug in that code path ... Fixes: CVE-2016-9603 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494419-14340-1-git-send-email-kraxel@redhat.com (cherry picked from commit 50628d3479e4f9aa97e323506856e394fe7ad7a6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21fix :cirrus_vga fix OOB read case qemu Segmentation faulthangaohuai
check the validity of parameters in cirrus_bitblt_rop_fwd_transp_xxx and cirrus_bitblt_rop_fwd_xxx to avoid the OOB read which causes qemu Segmentation fault. After the fix, we will touch the assert in cirrus_invalidate_region: assert(off_cur_end >= off_cur); Signed-off-by: fangying <fangying1@huawei.com> Signed-off-by: hangaohuai <hangaohuai@huawei.com> Message-id: 20170314063919.16200-1-hangaohuai@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 215902d7b6fb50c6fc216fc74f770858278ed904) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21Revert "cirrus: allow zero source pitch in pattern fill rops"Gerd Hoffmann
This reverts commit 5858dd1801883309bdd208d72ddb81c4e9fee30c. Conflicts: hw/display/cirrus_vga.c Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-2-git-send-email-kraxel@redhat.com (cherry picked from commit 12e97ec39931e5321645fd483ab761319d48bf16) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21cirrus: fix patterncopy checksGerd Hoffmann
The blit_region_is_unsafe checks don't work correctly for the patterncopy source. It's a fixed-sized region, which doesn't depend on cirrus_blt_{width,height}. So go do the check in cirrus_bitblt_common_patterncopy instead, then tell blit_is_unsafe that it doesn't need to verify the source. Also handle the case where we blit from cirrus_bitbuf correctly. This patch replaces 5858dd1801883309bdd208d72ddb81c4e9fee30c. Security impact: I think for the most part error on the safe side this time, refusing blits which should have been allowed. Only exception is placing the blit source at the end of the video ram, so cirrus_blt_srcaddr + 256 goes beyond the end of video memory. But even in that case I'm not fully sure this actually allows read access to host memory. To trick the commit 5858dd18 security checks one has to pick very small cirrus_blt_{width,height} values, which in turn implies only a fraction of the blit source will actually be used. Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-1-git-send-email-kraxel@redhat.com (cherry picked from commit 95280c31cda79bb1d0968afc7b19a220b3a9d986) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21cirrus: fix blit address mask handlingGerd Hoffmann
Apply the cirrus_addr_mask to cirrus_blt_dstaddr and cirrus_blt_srcaddr right after assigning them, in cirrus_bitblt_start(), instead of having this all over the place in the cirrus code, and missing a few places. Reported-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485338996-17095-1-git-send-email-kraxel@redhat.com (cherry picked from commit 60cd23e85151525ab26591394c4e7e06fa07d216) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21cirrus: allow zero source pitch in pattern fill ropsWolfgang Bumiller
The rops used by cirrus_bitblt_common_patterncopy only use the destination pitch, so the source pitch shoul allowed to be zero and the blit with used for the range check around the source address. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Message-id: 1485272138-23249-1-git-send-email-w.bumiller@proxmox.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 5858dd1801883309bdd208d72ddb81c4e9fee30c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21cirrus: handle negative pitch in cirrus_invalidate_region()Wolfgang Bumiller
cirrus_invalidate_region() calls memory_region_set_dirty() on a per-line basis, always ranging from off_begin to off_begin+bytesperline. With a negative pitch off_begin marks the top most used address and thus we need to do an initial shift backwards by a line for negative pitches of backward blits, otherwise the first iteration covers the line going from the start offset forwards instead of backwards. Additionally since the start address is inclusive, if we shift by a full `bytesperline` we move to the first address *not* included in the blit, so we only shift by one less than bytesperline. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Message-id: 1485352137-29367-1-git-send-email-w.bumiller@proxmox.com [ kraxel: codestyle fixes ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit f153b563f8cf121aebf5a2fff5f0110faf58ccb3) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-219pfs: don't try to flush self and avoid QEMU hang on resetGreg Kurz
According to the 9P spec [*], when a client wants to cancel a pending I/O request identified by a given tag (uint16), it must send a Tflush message and wait for the server to respond with a Rflush message before reusing this tag for another I/O. The server may still send a completion message for the I/O if it wasn't actually cancelled but the Rflush message must arrive after that. QEMU hence waits for the flushed PDU to complete before sending the Rflush message back to the client. If a client sends 'Tflush tag oldtag' and tag == oldtag, QEMU will then allocate a PDU identified by tag, find it in the PDU list and wait for this same PDU to complete... i.e. wait for a completion that will never happen. This causes a tag and ring slot leak in the guest, and a PDU leak in QEMU, all of them limited by the maximal number of PDUs (128). But, worse, this causes QEMU to hang on device reset since v9fs_reset() wants to drain all pending I/O. This insane behavior is likely to denote a bug in the client, and it would deserve an Rerror message to be sent back. Unfortunately, the protocol allows it and requires all flush requests to suceed (only a Tflush response is expected). The only option is to detect when we have to handle a self-referencing flush request and report success to the client right away. [*] http://man.cat-v.org/plan_9/5/flush Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Greg Kurz <groug@kaod.org> (cherry picked from commit d5f2af7b95b738b25272a98319b09540a0606d14) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-219pfs: fix off-by-one error in PDU free listGreg Kurz
The server can handle MAX_REQ - 1 PDUs at a time and the virtio-9p device has a MAX_REQ sized virtqueue. If the client manages to fill up the virtqueue, pdu_alloc() will fail and the request won't be processed without any notice to the client (it actually causes the linux 9p client to hang). This has been there since the beginning (commit 9f10751365b2 "virtio-9p: Add a virtio 9p device to qemu"), but it needs an agressive workload to run in the guest to show up. We actually allocate MAX_REQ PDUs and I see no reason not to link them all into the free list, so let's fix the init loop. Reported-by: Tuomas Tynkkynen <tuomas@tuxera.com> Suggested-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Greg Kurz <groug@kaod.org> (cherry picked from commit 0d78289c3dca3de8e614a551a3d4a9415168ace0) Conflicts: hw/9pfs/9p.c * drop context dep on 583f21f8 Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21target-arm: Fix aarch64 vec_reg_offsetRichard Henderson
Since CPUARMState.vfp.regs is not 16 byte aligned, the ^ 8 fixup used for a big-endian host doesn't do what's intended. Fix this by adding in the vfp.regs offset after computing the inter-register offset. Signed-off-by: Richard Henderson <rth@twiddle.net> Message-id: 1481085020-2614-2-git-send-email-rth@twiddle.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 416d72b97b01d6cb769ad0fd0e10614583354a45) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21target-arm: Fix aarch64 disas_ldst_single_structRichard Henderson
We add s->be_data within do_vec_ld/st. Adding it here means that we have the wrong bits set in SIZE for a big-endian host, leading to g_assert_not_reached in write_vec_element and read_vec_element. Signed-off-by: Richard Henderson <rth@twiddle.net> Message-id: 1481085020-2614-3-git-send-email-rth@twiddle.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 0a97c40f8e7172ac3d8db97fb22d0ef3025de307) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21linux-user: Fix s390x safe-syscall for z900Richard Henderson
The LT instruction was added in the extended immediate facility introduced with the z9-109 processor. Cc: Riku Voipio <riku.voipio@iki.fi> Reported-by: Michael Tokarev <mjt@tls.msk.ru> Fixes: c9bc3437a905b660561a26cd4ecc64579843267b Suggested-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Riku Voipio <riku.voipio@linaro.org> (cherry picked from commit 6cde51769e75d41cade0a5b3755da0c20a96309a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-21nbd/client: fix drop_sync [CVE-2017-2630]Vladimir Sementsov-Ogievskiy
Comparison symbol is misused. It may lead to memory corruption. Introduced in commit 7d3123e. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20170203154757.36140-6-vsementsov@virtuozzo.com> [eblake: add CVE details, update conditional] Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170307151627.27212-1-eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 2563c9c6b8670400c48e562034b321a7cf3d9a85) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-20thread-pool: add missing qemu_bh_cancel in completion functionPeter Lieven
commit 3c80ca15 fixed a deadlock scenarion with nested aio_poll invocations. However, the rescheduling of the completion BH introcuded unnecessary spinning in the main-loop. On very fast file backends this can even lead to the "WARNING: I/O thread spun for 1000 iterations" message popping up. Callgrind reports about 3-4% less instructions with this patch running qemu-img bench on a ramdisk based VMDK file. Fixes: 3c80ca158c96ff902a30883a8933e755988948b1 Cc: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit b7a745dc33a18377bb4a8dfe54d1df01ea60bf66) * drop context dep on b9e413d Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-20s390x/css: reassign subchannel if schid is changed after migrationDong Jia Shi
The subchannel is a means to access a device. While the device number is assigned by the administrator, the subchannel number is assigned by the channel subsystem in an ascending order on cold and hot plug. When doing unplug and replug operations, the same device may end up on a different subchannel; for example - We start with a device fe.1.2222, which ends up at subchannel fe.1.0000. - Now we detach the device, attach a device fe.1.3333 (which would get the now-free subchannel fe.1.0000), re-attach fe.1.2222 (which ends up at subchannel fe.1.0001) and detach fe.1.3333. - We now have the same device (fe.1.2222) available to the guest; it just shows up on a different subchannel. In such a case, the subchannel numbers are different from what a QEMU would create during cold plug when parsing the command line. As this would cause a guest visible change on migration, we do restore the source system's value of the subchannel number on load. So we are now fine from the guest perspective. From the host perspective this will cause an inconsistent state in our internal data structures, though. For example, the subchannel 0 might not be at array position 0. This will lead to problems when we continue doing hot (un/re) plug operations. Let's fix this by cleaning up our internal data structures. Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit 3c788ebc6f6eef5ac6e9cb4a28c578abcf08247d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16virtio-pci: reset modern vq meta dataJason Wang
We don't reset proxy->vqs[].{num|desc[]|avail[]|used[]}. This means if a driver enable the vq without setting vq address after reset. The old addresses were leaked. Fixing this by resetting modern vq meta data during device reset. Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 60a8d8023473dd24957b3a66824f66cd35b80d64) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16scsi: mptsas: fix the wrong reading size in fetch requestLi Qiang
When fetching request, it should read sizeof(*hdr), not the pointer hdr. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-Id: <1489488980-130668-1-git-send-email-liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit b01a2d07c963e96dbd151f0db1eaa06f273acf34) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16e1000e: correctly tear down MSI-X memory regionsPaolo Bonzini
MSI-X has been disabled by the time the e1000e device is unrealized, hence msix_uninit is never called. This causes the object to be leaked, which shows up as a RAMBlock with empty name when attempting migration. Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit 7ec7ae4b973d1471f6f39fc2b6481f69c2b39593) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16NetRxPkt: Account buffer with ETH header in IOV lengthDmitry Fleytman
In case of VLAN stripping ETH header is stored in a separate chunk and length of IOV should take this into account. This patch fixes checksum validation for RX packets with VLAN header. Devices affected by this problem: e1000e and vmxnet3. Cc: qemu-stable@nongnu.org Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit c5d083c561a4f5297cc2e44a2f3cef3324d77a88) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16NetRxPkt: Do not try to pull more data than presentDmitry Fleytman
In case of VLAN stripping, ETH header put into a separate buffer, therefore amont of data copied from original IOV should be smaller. Cc: qemu-stable@nongnu.org Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit d5e772146d2bbc92e5126c145eddef3b2843d026) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16NetRxPkt: Fix memory corruption on VLAN header strippingDmitry Fleytman
This patch fixed a problem that was introduced in commit eb700029. When net_rx_pkt_attach_iovec() calls eth_strip_vlan() this can result in pkt->ehdr_buf being overflowed, because ehdr_buf is only sizeof(struct eth_header) bytes large but eth_strip_vlan() can write sizeof(struct eth_header) + sizeof(struct vlan_header) bytes into it. Devices affected by this problem: vmxnet3. Cc: qemu-stable@nongnu.org Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit df8bf7a7fe75eb5d5caffa55f5cd4292b757aea6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16eth: Extend vlan stripping functionsDmitry Fleytman
Make VLAN stripping functions return number of bytes copied to given Ethernet header buffer. This information should be used to re-compose packet IOV after VLAN stripping. Cc: qemu-stable@nongnu.org Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit 566342c3125ac2e73abd36c650222318164517ed) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)Gerd Hoffmann
CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination and blit width, at all. Oops. Fix it. Security impact: high. The missing blit destination check allows to write to host memory. Basically same as CVE-2014-8106 for the other blit variants. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 92f2b88cea48c6aeba8de568a45f2ed958f3c298) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16hmp: fix block_set_io_throttleEric Blake
Commit 7a9877a made the 'device' parameter to BlockIOThrottle optional, favoring 'id' instead. But it forgot to update the HMP usage to set has_device, which makes all attempts to change throttling via HMP fail with "Need exactly one of 'device' and 'id'" CC: qemu-stable@nongnu.org Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20170120230359.4244-1-eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> (cherry picked from commit 3f35c3b166c18043596768448e5d91b5d52f8353) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16qga: ignore EBUSY when freezing a filesystemPeter Lieven
the current implementation fails if we try to freeze an already frozen filesystem. This can happen if a filesystem is mounted more than once (e.g. with a bind mount). Suggested-by: Christian Theune <ct@flyingcircus.io> Cc: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> (cherry picked from commit ce2eb6c4a044d809caf4dc4e08aed77678f9760e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16target-i386: correctly propagate retaddr into SVM helpersPaolo Bonzini
Commit 2afbdf8 ("target-i386: exception handling for memory helpers", 2015-09-15) changed tlb_fill's cpu_restore_state+raise_exception_err to raise_exception_err_ra. After this change, the cpu_restore_state and raise_exception_err's cpu_loop_exit are merged into raise_exception_err_ra's cpu_loop_exit_restore. This actually fixed some bugs, but when SVM is enabled there is a second path from raise_exception_err_ra to cpu_loop_exit. This is the VMEXIT path, and now cpu_vmexit is called without a cpu_restore_state before. The fix is to pass the retaddr to cpu_vmexit (via cpu_svm_check_intercept_param). All helpers can now use GETPC() to pass the correct retaddr, too. Cc: qemu-stable@nongnu.org Fixes: 2afbdf84807d673eb682cb78158e11cdacbf4673 Reported-by: Alexander Boettcher <alexander.boettcher@genode-labs.com> Tested-by: Alexander Boettcher <alexander.boettcher@genode-labs.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 65c9d60a3ad3249784348824eca69acac455bc02) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16apic: reset apic_delivered global variable on machine resetPavel Dovgalyuk
This patch adds call to apic_reset_irq_delivered when the virtual machine is reset. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-Id: <20170131114054.276.62201.stgit@PASHA-ISP> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit f65e821262029ee30c6b228e80ddeb86acdf7ff0) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16target/sparc: Restore ldstub of odd asisRichard Henderson
Fixes the booting of ss20 roms. Cc: qemu-stable@nongnu.org Reported-by: Michael Russo <mike@papersolve.com> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit 3db010c3398d03646d74f2d36a68e62539342e6c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16block/vmdk: Fix the endian problem of buf_len and lbaQingFeng Hao
The problem was triggered by qemu-iotests case 055. It failed when it was comparing the compressed vmdk image with original test.img. The cause is that buf_len in vmdk_write_extent wasn't converted to little-endian before it was stored to disk. But later vmdk_read_extent read it and converted it from little-endian to cpu endian. If the cpu is big-endian like s390, the problem will happen and the data length read by vmdk_read_extent will become invalid! The fix is to add the conversion in vmdk_write_extent, meanwhile, repair the endianness problem of lba field which shall also be converted to little-endian before storing to disk. Cc: qemu-stable@nongnu.org Signed-off-by: QingFeng Hao <haoqf@linux.vnet.ibm.com> Signed-off-by: Jing Liu <liujbjl@linux.vnet.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 20161216052040.53067-2-haoqf@linux.vnet.ibm.com Signed-off-by: Max Reitz <mreitz@redhat.com> (cherry picked from commit 4545d4f4af8b29ba3b38dfb74d6f45342e15a62d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16target-ppc, tcg: fix usermode segfault with pthread_create()Sam Bobroff
Programs run under qemu-ppc64 on an x86_64 host currently segfault if they use pthread_create() due to the adjustment made to the NIP in commit bd6fefe71cec5a0c7d2be4ac96307f25db56abf9. This patch changes cpu_loop() to set the NIP back to the pre-incremented value before calling do_syscall(), which causes the correct address to be used for the new thread and corrects the fault. Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> (cherry picked from commit 2635531f2006bfb0f943ad25b41e176709b79b37) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16vnc: do not disconnect on EAGAINMichael Tokarev
When qemu vnc server is trying to send large update to clients, there might be a situation when system responds with something like EAGAIN, indicating that there's no system memory to send that much data (depending on the network speed, client and server and what is happening). In this case, something like this happens on qemu side (from strace): sendmsg(16, {msg_name(0)=NULL, msg_iov(1)=[{"\244\"..., 729186}], msg_controllen=0, msg_flags=0}, 0) = 103950 sendmsg(16, {msg_name(0)=NULL, msg_iov(1)=[{"lz\346"..., 1559618}], msg_controllen=0, msg_flags=0}, 0) = -1 EAGAIN sendmsg(-1, {msg_name(0)=NULL, msg_iov(1)=[{"lz\346"..., 1559618}], msg_controllen=0, msg_flags=0}, 0) = -1 EBADF qemu closes the socket before the retry, and obviously it gets EBADF when trying to send to -1. This is because there WAS a special handling for EAGAIN, but now it doesn't work anymore, after commit 04d2529da27db512dcbd5e99d0e26d333f16efcc, because now in all error-like cases we initiate vnc disconnect. This change were introduced in qemu 2.6, and caused numerous grief for many people, resulting in their vnc clients reporting sporadic random disconnects from vnc server. Fix that by doing the disconnect only when necessary, i.e. omitting this very case of EAGAIN. Hopefully the existing condition (comparing with QIO_CHANNEL_ERR_BLOCK) is sufficient, as the original code (before the above commit) were checking for other errno values too. Apparently there's another (semi?)bug exist somewhere here, since the code tries to write to fd# -1, it probably should check if the connection is open before. But this isn't important. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1486115549-9398-1-git-send-email-mjt@msgid.tls.msk.ru Fixes: 04d2529da27db512dcbd5e99d0e26d333f16efcc Cc: Daniel P. Berrange <berrange@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 537848ee62195fc06c328b1cd64f4218f404a7f1) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16sd: sdhci: check data length during dma_memory_readPrasad J Pandit
While doing multi block SDMA transfer in routine 'sdhci_sdma_transfer_multi_blocks', the 's->fifo_buffer' starting index 'begin' and data length 's->data_count' could end up to be same. This could lead to an OOB access issue. Correct transfer data length to avoid it. Cc: qemu-stable@nongnu.org Reported-by: Jiang Xin <jiangxin1@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20170130064736.9236-1-ppandit@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 42922105beb14c2fc58185ea022b9f72fb5465e9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16block/nfs: fix naming of runtime optsPeter Lieven
commit 94d6a7a accidentally left the naming of runtime opts and QAPI scheme inconsistent. As one consequence passing of parameters in the URI is broken. Sync the naming of the runtime opts to the QAPI scheme. Please note that this is technically backwards incompatible with the 2.8 release, but the 2.8 release is the only version that had the wrong naming. Furthermore release 2.8 suffered from a NULL pointer dereference during URI parsing. Fixes: 94d6a7a76e9df9919629428f6c598e2b97d9426c Cc: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Message-id: 1485942829-10756-3-git-send-email-pl@kamp.de [mreitz: Fixed commit message] Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com> (cherry picked from commit f67409a5bb43ebe74401fa8e187267eb0f139293) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16block/nfs: fix NULL pointer dereference in URI parsingPeter Lieven
parse_uint_full wants to put the parsed value into the variable passed via its second argument which is NULL. Fixes: 94d6a7a76e9df9919629428f6c598e2b97d9426c Cc: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1485942829-10756-2-git-send-email-pl@kamp.de Signed-off-by: Max Reitz <mreitz@redhat.com> (cherry picked from commit 8d20abe87afa735cd0ae6688bd105c7a27390343) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-11-28 21:50:27 +0000